1. Scope and who we are
This Privacy Policy applies to KasaFlow websites, vendor registration and authentication, vendor dashboards, WhatsApp Business integrations, AI-assisted conversations, order and catalogue tools, subscription features, customer support, and related services (collectively, the “Services”). “KasaFlow,” “we,” “us,” and “our” refer to the operator of the KasaFlow platform.
This Policy applies to vendors, vendor personnel, prospective customers, website visitors, support contacts, and individuals whose information is processed through a vendor’s connected WhatsApp Business account. It does not replace a vendor’s own privacy notice to its customers and does not govern third-party products under their own privacy policies.
For privacy enquiries, the responsible KasaFlow contact is available at support@kasaflow.com.
2. Our data-protection roles
When KasaFlow acts as a data controller
KasaFlow determines the purposes and means of processing personal data used to operate our website, register and administer vendor accounts, manage subscriptions, authenticate users, prevent fraud and abuse, provide support, maintain service records, and comply with legal obligations.
When KasaFlow acts for a vendor
For customer messages, contact details, orders, delivery information, and other content a vendor submits or makes available through a connected workspace (“Customer Content”), the vendor generally determines why the information is processed. In that context, the vendor is the data controller and KasaFlow acts as its service provider or data processor, processing Customer Content according to the vendor’s instructions, our agreement, and applicable law.
Vendors must provide legally required notices, establish an appropriate lawful basis, honour customer rights, configure the assistant responsibly, and avoid collecting information that is unnecessary for their products or services.
3. Information we collect
The information collected depends on how a person or business interacts with the Services.
Information received from third parties
We may receive information from vendors and their authorized personnel, Meta and WhatsApp connection services, payment and mobile-money providers, email and authentication providers, security services, and other integrations a vendor chooses to enable. The data received depends on the integration, the vendor’s configuration, and the permissions granted.
Please do not submit passwords, verification codes, payment PINs, full card credentials, government identifiers, health information, or other sensitive personal data through chats or support channels unless KasaFlow has expressly requested it through a secure, designated process.
4. How and why we use information
We process personal data only where we have a lawful and appropriate reason. Depending on the circumstances and applicable law, those reasons may include performing a contract, taking requested pre-contract steps, complying with law, protecting legitimate interests, and obtaining consent.
- Provide the Services: create accounts and workspaces, connect authorized WhatsApp Business assets, deliver messages, generate configured replies, manage catalogues, capture orders, and display workspace activity.
- Authenticate and secure: verify email addresses, administer two-step verification and password recovery, manage sessions, investigate suspicious activity, prevent spam and fraud, and enforce platform rules.
- Manage subscriptions and payments: present plans, administer trials and token allowances, confirm payment status, reconcile transactions, keep accounting records, and address billing disputes.
- Support and communicate: respond to enquiries, deliver service and security notices, troubleshoot issues, and provide onboarding assistance.
- Maintain and improve: monitor availability and performance, diagnose faults, understand feature usage, improve reliability, and develop new functionality using aggregated or de-identified information where reasonably possible.
- Comply and protect: meet legal and regulatory duties, preserve records, respond to lawful requests, establish or defend legal claims, and protect KasaFlow, vendors, customers, and the public.
Where processing relies on consent, consent may be withdrawn at any time, without affecting processing already performed. Where processing is required to provide a requested service, refusing the required information may prevent us from providing that service.
5. WhatsApp Business and Meta services
When a vendor connects a WhatsApp Business account, KasaFlow may exchange account identifiers, access credentials or tokens, phone-number identifiers, message content and status, customer identifiers, templates, and connection metadata with Meta or WhatsApp as necessary to provide the integration. Vendors authorize this processing when they initiate and approve the connection.
Meta and WhatsApp may process information under their own terms and privacy notices. Their systems, availability, retention, and security practices are not controlled by KasaFlow. Vendors must comply with the WhatsApp Business Terms, messaging policies, consent requirements, and applicable laws when contacting customers.
6. AI and automated processing
KasaFlow uses artificial-intelligence services to interpret customer messages and produce suggested or automated responses based on information configured by the vendor, such as products, prices, availability, delivery rules, and business tone. Relevant message content and business context may be sent to contracted AI infrastructure for this purpose.
AI outputs may be incomplete or incorrect. Vendors are responsible for reviewing their configuration, monitoring assistant performance, maintaining accurate source information, and providing a reasonable path to human assistance. KasaFlow is not designed to make decisions that produce legal or similarly significant effects about individuals solely through automated processing.
Vendors must not configure the assistant to infer or make decisions based on sensitive characteristics, conduct unlawful profiling, provide regulated professional advice without qualified oversight, or request information that is excessive for the transaction.
8. How we disclose information
We do not sell personal data. We may disclose information only as reasonably necessary in the following circumstances:
- Vendors and authorized users: customer and workspace information is made available within the relevant vendor workspace according to configured access.
- Infrastructure and service providers: hosting, storage, database, email, security, customer-support, AI, analytics, and software providers process information to perform services for KasaFlow.
- Meta, WhatsApp, and integrations: information is exchanged when a vendor enables and uses an integration.
- Payment providers: transaction and account information may be shared to initiate, verify, reconcile, or investigate payments. Payment providers process payment credentials under their own policies and security obligations.
- Legal and safety recipients: regulators, courts, law enforcement, advisers, or affected parties may receive information where disclosure is required by law or reasonably necessary to protect rights, safety, security, or the integrity of the Services.
- Corporate transactions: information may be transferred in connection with a merger, financing, acquisition, restructuring, or sale of assets, subject to appropriate confidentiality and legal safeguards.
Service providers are expected to process information only for authorized purposes and to maintain appropriate confidentiality and security protections.
9. International data transfers
KasaFlow, vendors, Meta, AI providers, hosting providers, and other service providers may process information in countries other than the country where it was collected. Those countries may have different data-protection laws.
Where required, we use contractual, organizational, and technical safeguards intended to provide an appropriate level of protection and require processors handling data for KasaFlow to maintain confidentiality and security. Vendors are responsible for ensuring that their instructions and international use of Customer Content are lawful.
10. Data retention and deletion
We retain information only for as long as reasonably necessary for the purpose for which it was collected, including providing the Services, maintaining account and transaction history, honouring vendor instructions, resolving disputes, preventing fraud, enforcing agreements, and meeting legal, accounting, tax, and regulatory obligations.
Retention periods vary according to the type and sensitivity of information, the vendor’s configuration, account status, legal requirements, security needs, and whether information is required for an active dispute. When retention is no longer justified, information is deleted, anonymized, or isolated from active use. Residual copies may remain temporarily in protected backups until they are overwritten under normal backup cycles.
Closing a vendor account does not automatically require immediate deletion of every record. Some information may be retained where required by law, necessary for security or fraud prevention, or needed to establish or defend legal claims.
11. Security and incident response
We use administrative, technical, and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Measures may include access controls, authentication protections, transport security, environment separation, logging, monitoring, backups, vendor review, and incident-response procedures.
No system is completely secure. Vendors must protect account credentials, use strong unique passwords, restrict staff access, maintain secure devices, and promptly report suspected compromise. If a personal-data breach occurs, we will investigate and notify affected controllers, individuals, or regulators when required by applicable law.
12. Your rights and choices
Subject to applicable law and relevant exemptions, individuals may have rights to:
- be informed about the processing of their personal data;
- request access to and a description or copy of personal data;
- correct inaccurate, incomplete, misleading, or outdated information;
- request deletion, destruction, restriction, or blocking where legally available;
- object to processing that causes unwarranted damage or distress;
- object to or withdraw consent for direct marketing;
- withdraw consent where consent is the basis for processing;
- request reconsideration of certain significant decisions based solely on automated processing; and
- complain to a competent data-protection authority.
If your request concerns information controlled by a KasaFlow vendor, contact that vendor first. We will support the vendor in responding where required. Requests concerning data controlled by KasaFlow may be submitted to support@kasaflow.com. We may verify your identity, ask for information needed to locate the relevant records, and decline or limit a request where permitted by law or where fulfilling it would adversely affect another person’s rights.
13. Communications and direct marketing
We may send operational communications needed to administer an account or deliver the Services, including authentication, security, billing, service-status, and policy notices. These are not promotional messages and may be necessary while an account remains active.
We will send direct marketing where permitted by law and, where required, with prior consent. Recipients may opt out using the instructions in the communication or by contacting us. Opting out of marketing does not stop necessary service or security messages.
14. Children and sensitive personal data
KasaFlow is a business service and is not directed to children. Individuals must be at least 18 years old, or the age of legal majority where they live, to create or administer a vendor account. Vendors must not knowingly use the Services to collect children’s data without the authorization, notices, consent, and safeguards required by law.
Unless expressly supported under a separate written agreement, the Services are not intended for processing special-category or highly sensitive information such as health records, biometric identifiers, political opinions, religious beliefs, sexual-life information, or criminal allegations.
15. Third-party services and links
The Services may link to or integrate with websites and services operated by third parties. Their privacy and security practices are governed by their own notices and agreements. We encourage vendors and visitors to review those terms before enabling an integration or providing information.
16. Applicable privacy laws
This Policy is designed with the data-protection principles and individual rights established under Ghana’s Data Protection Act, 2012 (Act 843) in mind. Where another privacy law applies to particular processing, including the EU or UK General Data Protection Regulation, we will address applicable obligations and rights according to that law.
Nothing in this Policy limits rights that cannot lawfully be limited or creates rights beyond those provided by applicable law and our contractual commitments.
17. Changes to this Policy
We may update this Policy to reflect changes in the Services, technology, providers, legal requirements, or our processing practices. The revised version will be posted on this page with an updated date. If a change materially affects how we use personal data, we will provide additional notice where reasonably appropriate or legally required.
18. Contact and complaints
To exercise a privacy right, ask a question, or report a suspected privacy or security issue, email support@kasaflow.com. Include enough information for us to identify the relevant account or interaction, but do not send passwords, verification codes, payment PINs, or other secrets.
Individuals in Ghana may also raise concerns with the Data Protection Commission of Ghana. We encourage you to contact us first so we can investigate and attempt to resolve the issue.